add content

sec-policy/selinux-nextcloud/Manifest

@@ -0,0 +1,4 @@
+AUX nextcloud.te 1363 BLAKE2B b18c1a2a3a1cbefba0f0d8e56e38556a7778e4d41c5e8c0cbe7016417fe361a2c0b1a18c72b1c7a587fa81482295e3bf1a226ceb49f42d6ab439a1e6d2b418a6 SHA512 034ee58a7780a2f9ee098accbb2b4e5996153de7d5bf7f95cc932193f963fe7addc58dbb2f805d25bb6ec3ccc72707580ef321053d4d321fc3607d0f9f8d873c
+DIST patchbundle-selinux-base-policy-2.20180701-r1.tar.bz2 315378 BLAKE2B eeeb0b04c023c40289b6d964aefd1773d2b5d6912f1dffebf9509e6dcdbb39b17e722ee4483fb2b11193d4b987a85f90c7dc7e61cef3cf982fc2ba368d4900ef SHA512 a8b049120f1c420f9bfb55aba9ed0157ff7896ace402cd1b77b01d1ea52b67e49d915f1c00de83ff4d59b1cf8b8aa1f39b50ba312d842ed4850e75fcc7f5be42
+DIST refpolicy-2.20180701.tar.bz2 753050 BLAKE2B 7069a1b9b9bef25950e62bb50ac09f4a9d5ef6fd0acc667d321da396c3935939348534458df129f7bc81687dca240b4c4fc120d1f46d452665d335c9f023da8c SHA512 9dd5a1e10da5d25fea96cc25efb682f8ac866e835a1d940b161c1ce944cac9a90a5836b03c14311acad6bf9acd9a78003f36e050d35d8edb43606575523857b5
+EBUILD selinux-nextcloud-2.20180701-r1.ebuild 376 BLAKE2B 582ecbc77d098512f524daf539346819dc6c480a6d7754a6e2a4224485453f19ad1c906cdd42e92e72d1a2093fd47698e13847df575a60e7369b1d80c9d00181 SHA512 d287903678e45839041fcf06e19e2245d20d2ebc4ffea8dcd8b22000ce8bba362f5f943969723926e4b86fca62c885ad2a371273910631a62d2b4b122df6caf2

sec-policy/selinux-nextcloud/files/nextcloud.te

@@ -0,0 +1,57 @@
+policy_module(nextcloud, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+########################################
+#
+# lego local policy
+#
+
+gen_require(`
+       type phpfpm_t;
+       type phpfpm_tmp_t;
+       type etc_t;
+       type cert_t;
+       type httpd_sys_content_t;
+       type httpd_sys_rw_content_t;
+       class file { map open read };
+       class process sigkill;
+       class shm { create destroy read unix_read unix_write write };
+')
+
+optional_policy(`
+    gen_require(`
+       type system_cronjob_t;
+       type phpfpm_exec_t;
+    ')
+    cron_system_entry(phpfpm_t, phpfpm_exec_t)
+')
+
+corenet_udp_bind_generic_node(phpfpm_t)
+corenet_tcp_connect_http_port(phpfpm_t)
+# Allow to connect to IMAP/SMTP
+corenet_tcp_connect_pop_port(phpfpm_t)
+corenet_tcp_connect_smtp_port(phpfpm_t)
+
+fs_rw_hugetlbfs_files(phpfpm_t)
+allow phpfpm_t hugetlbfs_t:file map;
+
+allow phpfpm_t etc_t:file map;
+allow phpfpm_t phpfpm_tmp_t:file map;
+allow phpfpm_t httpd_sys_content_t:file map;
+allow phpfpm_t httpd_sys_rw_content_t:file map;
+
+allow phpfpm_t cert_t:file { open read };
+
+allow phpfpm_t self:process sigkill;
+allow phpfpm_t self:shm { create_shm_perms r_shm_perms };
+
+files_search_var(phpfpm_t)
+userdom_list_user_home_content(phpfpm_t)
+userdom_read_user_home_content_files(phpfpm_t)
+files_search_mnt(phpfpm_t)
+
+files_dontaudit_list_var(phpfpm_t)

sec-policy/selinux-nextcloud/selinux-nextcloud-2.20180701-r1.ebuild

@@ -0,0 +1,20 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+EAPI="5"
+
+IUSE=""
+MODS="nextcloud"
+POLICY_FILES="nextcloud.te"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for nextcloud"
+
+RDEPEND="sec-policy/selinux-base-policy"
+
+if [[ $PV == 9999* ]] ; then
+        KEYWORDS=""
+else
+        KEYWORDS="amd64 x86"
+fi